Adversarial attacks have been studied extensively for recognition tasks in ITS. Examples include mis-classifying traffic signs at various angles and distances to a vehicle [1]} and mis-classifying license plates to an optical character recognition system [2]}. For control tasks in ITS, there exist studies concerning the coordination of autonomous vehicles. In particular, a single adversarial vehicle is found capable of destabilizing an entire vehicular platoon, causing possible catastrophic accidents [3]}. More recently, adversarial attacks are crafted for in-vehicle networks, where a black-box attacker successfully degrades the performance of the deep learning model [4]}. While adversarial attacks in ITS have received increasing attention in recent years, to the best of our knowledge, studies that explore the adversarial vulnerability of traffic state prediction models are scarce. In this work, we develop a black-box adversarial attack framework for network-wide, multi-step traffic state prediction models.
